Subject: RE: [mobile-ip] LMM requirements: security issue

From: "Alan O'Neill" <[email-masked]>
Date: Wed, 4 Sep 2002 21:39:35 -0400

So the chain of trust as a supplement to e2e is fine in your book but not as
a replacement yes ?

-----Original Message-----
From: James Kempf [mailto:[email-masked]]
Sent: 04 September 2002 02:16
To: Alan O'Neill; Hesham Soliman (EAB); [email-masked];
[email-masked]
Subject: Re: [mobile-ip] LMM requirements: security issue

I think we want to maintain end-to-end security for MIPv6. It is necessary
for
the IPsec SA used to secure binding update traffic, for example.

The issue is the extra tunnel overhead, especially on the wireless link,
though
also on any T1 links from the aggregation router to the access router.
Header
compression can help, but there are issues on handoff.

            jak

----- Original Message -----
From: "Alan O'Neill" <[email-masked]>
To: "Hesham Soliman (EAB)" <[email-masked]>;
<[email-masked]>; <[email-masked]>
Sent: Monday, September 02, 2002 1:56 AM
Subject: RE: [mobile-ip] LMM requirements: security issue

> A bit late I know due to a bout of flu..
>
> Just wanted to mention that Nested MIP also supports these apparently
> conflicting requirements because once again it is the MN that registers
the
> Regional address (RoA) into the global HA.
>
> There is also the option for the MN to register via the Regional Mobility
> Agent (RMA) which I guess has some similarities to your extended mode
Hesham
> in its security implications..
>
> I for one though would suggest that the LMM requirements are somewhat
harsh
> in that a MN SHOULD be able to use end to end security and employ a direct
> MIP BU, but MAY alternatively go via a trusted intermediate element, and
use
> a chain of trust that maybe in place between these elements either as a
> supplement or a replacement to the e-e security approach.
>
> Any push-back on that ?
>
> -----Original Message-----
> From: Hesham Soliman (EAB) [mailto:[email-masked]]
> Sent: 26 August 2002 22:49
> To: [email-masked]'; [email-masked]
> Subject: RE: [mobile-ip] LMM requirements: security issue
>
>
> Theo,
>
>   > In addition to what I have mentioned previously I would
>   > like to add that
>   > I believe that two more requirements are conflicting about security:
>   >
>   > In A:
>   >    it is required that the LMM agent does not interfere with the
>   > security bindings between the MN and the peers
>   >
>   > whereas on B:
>   >
>   >  it is required that the MN preserves location privacy under LMM.
>   >
>   > I cannot see how one can maintain location privacy (B) of
>   > the MN without
>   > breaking the end-to-end principle (A) in terms of security
>   > bindings.
>
> => These are requirements and are not meant to show how
> it can be done. Of course we don't want to place impossible
> requirements, but as Greg explained, this is already doable
> to a large extent with the existing HMIPv6, so I don't think
> it's impossible.
>
> Hesham
>

---

From: "James Kempf" <[email-masked]>
Date: Thu, 5 Sep 2002 08:10:39 -0700

I think the trust relationship between a MAP and a host must be the same as
between any router in the foreign domain and the host.

It is not a replacement for the e2e trust relationship with the home agent, nor
would I characterize it as a chain of trust, since it does not extend back to
the home agent in any way. Or did you have something else in mind?

There is, of course, an issue about how the host verifies the trust relationship
with the routers in the foreign domain in the first place. This is currently an
open issue that the SEND BOF addressed. But assuming a mechanism for that, the
trust relationship with the MAP can derive in some way from the trust
relationship with the routers, perhaps using the same mechanism but requiring
additional steps (obtaining a certificate or key for the MAP through the trusted
access router, etc.).

I'm sure this will need to be spelled out, in some amount of detail, in the spec
before it will get IESG approval, but the important point now is that we can
achieve agreement on what the general framework is for security between the MAP
and the host, so we can fill in the details.

            jak

----- Original Message -----
From: "Alan O'Neill" <[email-masked]>
To: "'James Kempf'" <[email-masked]>; "Hesham Soliman (EAB)"
<[email-masked]>; <[email-masked]>;
<[email-masked]>
Sent: Wednesday, September 04, 2002 6:39 PM
Subject: RE: [mobile-ip] LMM requirements: security issue